A compromised principal has permission to list role assignments.

olivia.admin@cloudcorpsec.onmicrosoft.com

Detailed Solution:

Run:

az role assignment list \

--resource-group rg-prod-apps-eastus \

--all \

--output table

Or filter by role:

az role assignment list \

--resource-group rg-prod-apps-eastus \

--role " User Access Administrator " \

--query " [].{Principal:principalName,Role:roleDefinitionName,Scope:scope} " \

--output table

Expected output:

Principal Role Scope

------------------------------------- ------------------------- ----------------------------

olivia.admin@cloudcorpsec.onmicrosoft.com User Access Administrator /subscriptions/.../rg-prod-apps-eastus

Final answer:

olivia.admin@cloudcorpsec.onmicrosoft.com

================